Falhas do tipo CWE-122

3.189 resultados

Estouro de heap

Ocorre quando código escreve mais dados do que o espaço alocado em uma região de memória dinâmica (heap), sobrescrevendo dados adjacentes. Um atacante pode explorar isso para corromper estruturas de dados críticas, contornar proteções de segurança ou executar código arbitrário.

Exemplo

Um servidor web aloca 256 bytes para armazenar um nome de usuário, mas copia 512 bytes de uma requisição sem validação. Os 256 bytes extras sobrescrevem ponteiros ou metadados do heap, permitindo execução de código ou negação de serviço.

Como mitigar

Use funções seguras que respeitam limites (strcpy_s, memcpy com tamanho verificado em runtime). Validar e limitar o tamanho de entrada antes de copiar. Ativar proteções como ASLR, stack canaries e ferramentas de sanitização (AddressSanitizer) em desenvolvimento.

CVE-2025-21241HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-21239HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-21248HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-43589HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-36425HIGHWindows Distributed File System (DFS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2022-41991CRITICALA heap-based buffer overflow vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A EPSS 1.5%CVE-2020-28595HIGHAn out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4EPSS 1.5%CVE-2026-25589HIGHRedisBloom RESTORE invalid memory access may allow remote code executionEPSS 1.5%CVE-2024-49004HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-49001HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-49005HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-49000HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-49002HIGHSQL Server Native Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-27487HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-28275HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-32324HIGHOpenPrinting CUPS vulnerable to heap buffer overflowEPSS 1.5%CVE-2021-3984HIGHHeap-based Buffer Overflow in vim/vimEPSS 1.5%CVE-2025-24051HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-43453HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-1538HIGHD-Link DAP-1320 api set_ws_action heap-based overflowEPSS 1.5%